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PREAMBLE 
THE EUROPEAN DATA PROTECTION BOARD, 


Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 
27 April 2016 on the protection of natural persons with regard to the processing of personal 
data and on the free movement of such data, and in particular Article 72(2) thereof, 


having regard to Directive (EU) 2016/680 of the European Parliament and of the Council of 27 
April 2016 on the protection of natural persons with regard to the processing of personal data 
by competent authorities for the purposes of the prevention, investigation, detection or 
prosecution of criminal offences or the execution of criminal penalties, and on the free 
movement of such data, and repealing Council Framework Decision 2008/977/JHA, 


having regard to the EEA Agreement and in particular to Annex XI and Protocol 37 thereof, as 
amended by the Decision of the EEA Joint Committee No 154/2018 


whereas: 


(1) The protection of natural persons in relation to the processing of personal data is a 
fundamental right enshrined in Article 8 (1) of the Charter of Fundamental Rights (the 
“Charter”) and Article 16 (1) of the Treaty on the Functioning of the European Union. 


(2) Regulation (EU) 2016/679 (the “GDPR”) provides for the establishment of an independent 
body of the Union, referred to as the European Data Protection Board, responsible for 
ensuring the consistent application of the GDPR and for promoting cooperation between 
supervisory authorities throughout the Union. 


(3) The GDPR also provides for the tasks of the Board, for the Chair and deputy chairs, and the 
secretariat. 


(4) Directive (EU) 2016/680 (the “Police and Criminal Justice Data Protection Directive”) 
provides for additional tasks for the Board, for the Chair and deputy chairs, and the 
secretariat. 


(5) Regulation 2018/1725 provides for rules on the protection of natural persons with regard 
to the processing of personal data by the Union institutions, bodies, offices and agencies and 
on the free movement of such data. 


(6) Other provisions of Union law may provide for additional tasks for the Board. 


(7) The EEA Agreement incorporated the GDPR and provides that the supervisory authorities 
of the EFTA EEA States and the EFTA Surveillance Authority shall participate in the activities 
of the Board and the Rules of Procedure of the European Data Protection Board shall give full 


effect to this participation. While not having the right to vote, EFTA EEA supervisory 
authorities shall have the right to express their positions on all items discussed and / or voted. 


HAS ADOPTED THE FOLLOWING RULES OF PROCEDURE: 


TITLE | — The BOARD 
Article 1 — Identity 


The European Data Protection Board (the “Board”) is an EU body with legal personality that 
shall act independently when performing its tasks or exercising its powers. The Board is 
established in Brussels where all principal activities shall take place. 


Article 2 — Missions 


The Board shall ensure the consistent application of the GDPR and shall also ensure the 
performance of the tasks mentioned in the Police and Criminal Justice Data Protection 
Directive and other applicable legislative instruments under EU law. 


Article 3 — Guiding principles 
Principle of independence and impartiality 


In accordance with the principle of independence enshrined in Article 69 GDPR, the Board 
shall act impartially and in complete independence when performing its tasks or exercising its 
powers. 


Principles of good governance, integrity and good administrative behaviour 


In accordance with the principles of good governance, integrity and good administrative 
behaviour, the Board shall act in the public’s interest as an expert, reliable and authoritative 
body in the field of data protection with good decision-making processes and sound financial 
management. 


Principle of collegiality and inclusiveness 


In accordance with the principle of collegiality and inclusiveness, and pursuant to the 
provisions of the GDPR and the Police and Criminal Justice Data Protection Directive, the 
Board shall be organised and shall act collectively as a collegiate body. 


Principle of cooperation 


In accordance with the principle of cooperation, the Board shall promote cooperation 
between supervisory authorities and endeavour to operate where possible by consensus, and 
subject to the GDPR and the Police and Criminal Justice Data Protection Directive. 


Principle of transparency 


In accordance with the principle of transparency, the Board shall operate as openly as possible 
so as to be more effective and more accountable to the individual. The Board shall explain its 
activities in a clear language which is accessible to all. 


Principle of efficiency and modernisation 


In accordance with the principle of efficiency and modernisation, the Board shall operate 
efficiently and as flexible as possible so to achieve internally the highest level of synergies 
among its members. The efficiency and modernisation principle shall be realised by using new 
technologies to help bring efficiencies to current working methods such as the minimisation 
of formalities and providing efficient administrative support. 


Principle of proactivity 


In accordance with the principle of proactivity, the Board shall, acting on its own initiative, 
anticipate and support innovative solutions to help overcome digital challenges to data 
protection. Thus ensuring by means of the effective participation of stakeholders (members, 
observers, staff and invited experts), that real-life needs and aspirations are fully taken into 
account. 


TITLE Il — COMPOSITION 
Article 4 — Membership and Participation 


1. The Board shall be composed of the head of one supervisory authority of each Member 
State and EFTA EEA State or the joint representative pursuant to Article 68 (4) GDPR, and 
the European Data Protection Supervisor (the “EDPS”), or their respective representatives 
(hereinafter “the members”). As to the activities of the Board relating to the GDPR, EFTA 
EEA supervisory authorities shall have the same rights and obligations as supervisory 
authorities of the EU Member States, except for the right to vote and to stand for election 
as Chair or deputy chairs or unless otherwise provided for in these rules. They shall have 
the right to express their positions on all items discussed and/or voted. 


2. The European Commission (the “Commission”) shall have the right to participate in the 
activities of the Board without voting rights and shall designate a representative. The EFTA 
Surveillance authority shall have the right to participate without voting rights to the 
activities of the Board relating to the GDPR and shall designate a representative. 


3. Where in a Member State there is more than one supervisory authority responsible for 
monitoring the application of the provisions pursuant to the GDPR, the Police and Criminal 
Justice Data Protection Directive, or any other EU applicable law, in accordance with 
national laws, a joint representative shall be designated. The same applies to EFTA EEA 


5. 


supervisory authorities responsible for monitoring the application of the provisions 
pursuant to the GDPR. 


. In the absence of the head of a supervisory authority at meetings of the Board, 


representatives shall be designated by their respective supervisory authorities and shall be 
entitled to attend and participate with voting rights. The joint representative may be 
accompanied by the head of another supervisory authority of their State or its 
representative, who could also act as a representative pursuant to the first sentence of 
this paragraph of these Rules of Procedure, as necessary in accordance with that Member 
State's law. 


The heads of national supervisory authorities, the EDPS or their representatives as well as 
representatives of the Commission and the EFTA Surveillance Authority may be assisted by 
their staff members. The number of staff members per delegation attending the meetings 
should be limited to the minimum necessary taking into account the importance and 
variety of issues to be addressed. 


Article 5 — Appointment and term of office of the Chair and deputy chairs 


1. 


The Board, through secret ballot, elects a Chair and two deputy chairs by simple majority 
of members entitled to vote that are present or represented through delegation according 
to Article 22 (5) of the Rules of Procedure. 


. The term of office of the Chair and of the deputy chairs shall be five years, starting from 


the date of their respective election. The Chair and deputy chairs may be reelected once 
for a further five years. 


. At least two months before the end of the mandate of the Chair or the deputy chairs, the 


secretariat shall call for the elections to replace the outgoing member. 


When the mandate finishes for the reasons set out in Article 6, the secretariat shall 
convene for elections no later than one week after the communication provided for in 
Article 6 (1) or after the dismissal provided for in Article 6 (2). 


. Candidates shall be submitted to the secretariat and to the Chair in writing at least 1 month 


before the election. The secretariat shall circulate the list of candidates to the members 
no later than three weeks before the election. 


. If only one candidate is presented for the position of the Chair or of the deputy chair, the 


candidate shall be elected provided that they receive the support of the simple majority. 
Should the candidate not receive that support in the first round, or in cases where there is 
more than one candidate and there is no majority for one candidate, the vote should be 


repeated. If there is no simple majority supporting the only or any candidate in the second 
round, a new invitation for candidates shall be opened without delay. 


Article 6 — End of term and dismissal of the Chair and deputy chairs 


1. The term of the office of the Chair and of the deputy chairs is terminated as soon as the 
term of office at their supervisory authority ends, or when the five-year term of office ends, 
or in case of resignation, or in case of dismissal pursuant to Article 6 (2). The Chair or 
deputy chairs shall inform the secretariat two months in advance of the effective end of 
their term or of their intention to resign. If that is not possible due to the conditions of 
national procedures, the Chair or deputy chairs shall inform the secretariat immediately 
after their replacement as head of their supervisory authority is confirmed. In case of 
termination of the function before the full term of office, new elections shall take place as 
soon as possible for a new mandate (Article 73 (2) GDPR). 


2. Upon receiving a reasoned proposal by at least a 1/3 of its members to dismiss the current 
Chair and/or deputy chairs, the Board shall decide by a simple majority to adopt a decision 
to dismiss the Chair and/or deputy chair(s). 


Article 7 — Duties of the Chair and deputy chairs 


1. In addition to its tasks according to Article 74 GDPR, the Chair shall be responsible for 
representation of the Board according to Article 68 (2) GDPR. The Chair shall act according 
to a mandate of the Board and may designate a deputy chair, any member of a supervisory 
authority or a member of the secretariat to represent the Board externally on their behalf. 
The Chair shall inform all members of the Board of any planned external engagements and 
contacts, as well as on the designation of a representative if any, and report on their 
results. 


2. After each election of the Chair and/or deputy chairs, the Chair shall, after consultation 
with the deputy chairs, submit a proposal to the Board for the allocation of tasks among 
them including the acting on behalf of each other in cases of non-availability or incapacity. 
The Chair might delegate to the deputy chairs the competence to sign documents. 


The Chair’s proposal shall be considered as agreed upon, unless 1/3 of the members of the 
Board objects. 


Article 8 — Observers 


1. Without prejudice to any relevant international agreement between the Union and a non- 
EU country, providing for a specific status for the data protection authority of this non-EU 
country within the Board, the Board upon request may decide to grant a non-EU country 
data protection authority the status of an observer, if it is in the interest of the Board and 
the following cumulative conditions are met: 


e the data protection authority of the non-EU country acts with complete 
independence; 

e the data protection authority is established in a non-EU country which with a view 
to acceding to the European Union has undertaken binding international 
commitments to fully align its data protection rules with those of the EU. 


. Observers shall not participate in expert subgroups and plenary meetings of the Board or 


parts of them relating to the preparation, discussion and adoption of measures under 
Chapter VII, Section | and Il and opinions under Article 70 (1) (s) of the GDPR. As regards 
Chapter VII, Section | and opinions under Article 70 (1) (s) of the GDPR, an observer could 
attend on a case by case basis provided that it is (i) in the interest of the Board and the 
respective observer and (ii) in line with applicable confidentiality requirements. The 
decision of granting attendance to (i) a plenary meeting is taken by the Chair and (ii) to an 
expert subgroup meeting by the respective coordinator, subject to the prior information 
of the Chair. 


. Observers shall not be reimbursed for their attendance to meetings. 


. The secretariat of the Board shall ensure that relevant information shall be shared with 


observers. 


. Observers participating in an expert subgroup or a plenary meeting must be mentioned in 


the minutes. 


. The observers shall be bound by the same confidentiality requirements as the members of 


the Board as provided for in Article 54 (2) GDPR and Article 33 of these Rules of Procedure. 


. Observer status may be revoked by a reasoned decision of the Board, in particular if any 


of the conditions laid down in paragraph 1 of this Article is not met anymore. 


Article 9 — Experts, guests and other external parties 


1. 


Unless a majority of the members of the Board or the Chair objects, upon proposal of any 
member of the Board or of any expert subgroup, the Chair may invite via the secretariat 
external experts, guests or other external parties to take part in a plenary meeting and 
may indicate the topics in the agenda which they are invited to attend. 


. Unless a majority of the members of the Board or the Chair objects, upon proposal of any 


member of the Board or of any expert subgroup, the coordinator of an expert subgroup 
may invite via the secretariat external experts, guests or other external parties to take part 
in a meeting of the expert subgroup. 


3. The invited experts, guests or other external parties participating in a subgroup meeting 
must be mentioned in the respective agenda and in the minutes. 


4. Experts, guests and other external parties shall be bound by the same confidentiality 
requirements as the members of the Board as provided for in Article 54 (2) GDPR and 
Article 33 of these Rules of Procedure. 


TITLE III — ADOPTION OF DOCUMENTS AND PROCEDURE 
Article 10 — Opinions of the Board under Article 64 GDPR 


1. In cases referred to in Article 64 (1) GDPR, the competent supervisory authority shall send 
any relevant documents including the draft decision for the opinion of the Board to the 
secretariat via the Board IT system. The secretariat should pre-check if all the documents 
are complete. The secretariat may request the competent supervisory authority to 
provide the secretariat within a specific timeframe with additional information needed 
for the file to be complete. When necessary, the documents submitted by the competent 
authority will be translated into English by the secretariat without undue delay. When the 
competent authority agrees on the translation, and the Chair and the competent 
supervisory authority decide that the file is completed, the secretariat on behalf of the 
Chair will circulate the file to the members of the Board according to Article 64 (5) (a) 
GDPR. According to the last sentence of Article 64 (3) GDPR, the Chair may indicate a 
period between two and three weeks, unless it concerns an entirely new or complicated 
issue which requires a longer time, within which the members which have not objected 
shall be deemed in agreement with the draft decision of the supervisory authority (“non- 
objection procedure”). 


2. According to paragraph 1 of this Article, the opinion of the Board shall be adopted within 
eight weeks after the Chair and the competent supervisory authority have decided that 
the file is complete. It may be extended by a further 6 weeks, taking into account the 
complexity of the subject matter, upon decision of the Chair on its own initiative or at the 
request of at least 1/3 of the members of the Board. The non-objection procedure 
referred to in paragraph 1 of this Article shall take place during this period, as well as the 
adoption of the Board following this procedure referred to in paragraph 5 hereafter. 


3. Requests shall be provided with reasoning pursuant to Article 64 (2) GDPR. The Board may 
decide without undue delay and within a deadline set by the Chair not to give an opinion 
under Article 64 (2) GDPR, if the criteria are not met. 


4. In accordance with Article 64 (3) GDPR, the Board may decide without undue delay and 
within a deadline set by the Chair, not to give an opinion under Article 64 (1) and (2) GDPR, 
because another opinion on the same matter may have already been issued. The opinion 
of the Board shall be adopted within eight weeks after the Chair and competent 
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supervisory authority/Commission/EFTA Surveillance Authority have decided that the file 
is complete. It may be extended by a further 6 weeks, taking into account the complexity 
of the subject matter, upon decision of the Chair on its own initiative or at the request of 
at least 1/3 of the members of the Board. 


According to paragraph 1, last sentence, of this Article, and in accordance with Article 64 
(3) last sentence GDPR, and unless exceptional circumstances arise, in case no member of 
the Board objected to the draft decision of the supervisory authority submitted to the 
Board under Article 64 (1) GDPR, the Board shall adopt a favourable opinion on the draft 
decision submitted. In case at least one member of the Board objected to the draft 
decision of the supervisory authority during the period set by the Chair according to 
paragraph 1, last sentence, the non-objection procedure is terminated and the Board shall 
immediately start examining the objection(s) while preparing the opinion on the draft 
decision according to the procedure set out in Article 64 (1) GDPR. Member(s) of the 
Board should provide reasons when objecting to a draft decision submitted to the Board 
during a “non-objection procedure” as referred in paragraph 1, last sentence, of this 
Article. 


Before being submitted to the vote of the Board, opinions shall be prepared and drafted 
by the secretariat and, upon decision of the Chair, together with a rapporteur and expert 
subgroups members. 


When, according to Article 64 (7) GDPR, the competent supervisory authority referred to 
in Article 64 (1) GDPR communicates its intention to the Chair to maintain or amend its 
draft decision following the Board’s opinion, or when the competent supervisory 
authority informs the Chair of the Board that it does not intend to follow the opinion of 
the Board, in whole or in part according to Article 64 (8) GDPR, the secretariat shall, on 
behalf of the Chair, circulate this information and, if any, the amended draft decision 
submitted by the national supervisory authority to the members of the Board. 


When the competent supervisory authority referred to in Article 64 (1) GDPR declares that 
it would, in whole or in part, follow the opinion of the Board, and consequently either 
maintains or amends its draft decision, the rapporteur, the expert subgroup members and 
the secretariat who prepared the opinion of the Board in accordance with paragraph 6 of 
this Article should where relevant inform the Board as soon as possible on how in their 
view the amended decision submitted under paragraph 7 of this Article by this supervisory 
authority takes into account the opinion of the Board. The supervisory authority 
concerned should be given the opportunity to provide information in this respect. The 
secretariat will circulate this information to the members of the Board. 
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10. 


When a supervisory authority indicates to the Chair that it will not, in whole or in part, 
follow the opinion of the Board, Article 65 (1) GDPR shall apply as provided for in Article 
64 (8) GDPR. Hence, without prejudice to the right of any other supervisory authority 
concerned, the Commission or the EFTA Surveillance Authority to refer the matter to the 
Board under Article 65 (1) (c) GDPR, the Chair or a Deputy Chair may refer the matter to 
the Board under Article 65 (1) (c) GDPR as soon as possible. 


In any case, following the adoption of its opinion under Article 64 (1) GDPR, the Board will 
not adopt any opinion under Article 64 GDPR or any other position in the context of this 
same Article 64 GDPR procedure, neither to acknowledge that the draft decision can be 
adopted without any amendment, nor to state whether an amended national draft 
decision submitted under Article 64 (7) GDPR is in line or not with the EDPB’s opinion 
adopted under Article 64 (1) GDPR. 


Article 11 — Binding decision of the Board 


1. The Board shall respect the right to good administration as set out by Article 41 of the 


Charter. Before taking decisions, the Board shall make sure that all persons that might be 
adversely affected have been heard. 


2. The lead supervisory authority shall submit the matter to the secretariat via the 


information and communication system mentioned in Article 17 of these Rules of 
Procedure. In case of Article 65 (1) (a) GDPR, the lead supervisory authority when 
submitting the matter to the secretariat shall include: 


a) the draft decision or revised draft decision subject to the objection(s); 
b) asummary of the relevant facts and grounds; 


c) the objection(s) made by the supervisory authority(/-ies) concerned in accordance 
with Article 60 (4) (and where relevant Article 60 (5)) GDPR; 


d) an indication as to whether the lead supervisory authority does not follow the 
relevant and reasoned objection or is of the opinion that the objection is not relevant 
or reasoned; 


e) documentation proving the timing and format of the provision of the (revised) draft 
decision and of the objection(s) by the supervisory authority(/-ies) concerned, in order 
to allow the secretariat to verify the objection has been provided in writing and within 
the legal deadline (e.g. the relevant and reasoned objections report from the 
information and communication system mentioned in Article 17 of these Rules of 
Procedure ); and 


f) in accordance with Article 41 of the Charter, the written observations the lead 
supervisory authority collected from the persons that might be adversely affected by 


12 


the Boards decision, together with confirmation and evidence of which documents 
submitted to the Board were provided to them when they were invited to exercise 
their right to be heard or a clear identification of the elements for which it is not the 
case. 


The Chair and the lead supervisory authority are responsible for deciding whether the file 
is complete. The secretariat carries out the analysis on the completeness of the file on 
behalf of the Chair. In addition, the secretariat may request from the lead supervisory 
authority and/or the supervisory authority(/-ies) concerned, within a specific timeframe 
additional information needed, eg. a confirmation that the draft decision should be 
considered as such in line with the GDPR. When necessary, the documents submitted by 
the competent authority will be translated into English by the secretariat. Once the 
competent authority agrees on the translation and the Chair and the lead supervisory 
authority have decided that the file is complete, the secretariat on behalf of the Chair will 
refer the subject-matter to the members of the Board without undue delay. If the lead 
supervisory authority fails to provide the information listed above within the set 
timeframe, the Chair will ask the secretariat to refer the subject-matter to the Board. 


To take its final decision, the Board shall take into account only the documents which were 
provided by the lead supervisory authority and the other supervisory authority(/-ies) 
concerned before the matter is referred to the Board. The Board will further take into 
account information that is potentially gathered in the context of ensuring the right to be 
heard of the affected parties. 


However, in exceptional circumstances, the Board can decide to consider further 
documents it deems necessary. 


. In cases of Article 65 (1) (b) and (c) GDPR, when the subject-matter is referred to the 
secretariat, the competent supervisory authorities, the Commission or the EFTA 
Surveillance Authority shall communicate all relevant documents. When necessary, the 
documents submitted will be translated into English by the secretariat without undue 
delay. Once the Chair and the competent supervisory authorities/Commission/EFTA 
Surveillance Authority have decided that the file is completed, the subject-matter is 
referred via the secretariat to the members of the Board without undue delay. 


. The decision of the Board shall be adopted within one month after the Chair and the 
competent supervisory authority/Commission/EFTA Surveillance Authority have decided 
that the file is complete. It may be extended by a further month, taking into account the 
complexity of the subject matter upon decision of the Chair on its own initiative or at the 
request of at least 1/3 of the members of the Board. 
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5. 


6. 


Before being submitted to the vote of the Board, decisions shall be prepared and drafted 
by the secretariat and, upon decision of the Chair, together with a rapporteur and expert 
subgroups members. 


After the adoption of the binding decision, the EDPB Secretariat shall, on behalf of the 
Chair, notify without undue delay the decision in English, which shall be considered as the 
only authentic language of the decision, to the supervisory authorities concerned via the 
information and communication system mentioned in Article 17 of these Rules of 
Procedure. The supervisory authorities concerned will be deemed to be fully acquainted 
with the decision as notified. 


Before proceeding with the notification, translations shall be urgently made available by 
the EDPB Secretariat to, and urgently proofread by, the supervisory authorities concerned 
that have to adopt a decision or take measures at national level on the basis of the binding 
decision. These urgent translations will be in the official EU language(s) of these 
supervisory authorities. 


Other supervisory authorities concerned can exceptionally request an urgent translation 
in their official EU language(s) no later than at the moment of adoption of the binding 


decision, providing the reasons for this request. 


The EDPB shall not be responsible for any use of the translations provided. 


Article 12 — Opinions, guidelines, recommendations and best practices of the Board 


1. 


In cases covered by Article 70 (1) (d), (e), (f), (g), (h), (i), (i), (k), (m), (p), (a), (r), (s) and (x) 
GDPR and Article 51 of the Police and Criminal Justice Data Protection Directive, the Board 
shall issue opinions, guidelines, recommendations or best practices. 


. Before being submitted to the vote of the Board, opinions, guidelines, recommendations 


and best practices of the Board referred to in paragraph (1) shall be prepared by a 
rapporteur, by expert subgroups in liaison with the secretariat. 


Article 13 — Urgency procedure 


1. 


In the case of an urgency procedure, as defined under Article 66 GDPR, the deadlines 
mentioned in Articles 11 (4) and 10 (2) shall be reduced to two weeks and the documents 
shall be adopted by the simple majority of the members. 


. The supervisory authority requesting an urgent opinion or decision shall explain the 


reasons why such an urgent opinion or decision has to be adopted and shall submit any 
relevant document. When necessary, the documents submitted by the competent 
supervisory authority shall be translated into English by the secretariat. Once the Chair and 
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the competent supervisory authority have decided that the file is complete, it is 
communicated via the secretariat to the members of the Board without undue delay. 
TITLE IV — SECRETARIAT AND ORGANISATION 
Article 14 — Secretariat of the Board 


1. Pursuant to Article 75 (1) GDPR the EDPS shall provide the secretariat of the Board, the 
task of which is to provide analytical, administrative and logistical support to the Board. 
Pursuant to Article 75 (2) GDPR the secretariat shall perform its tasks exclusively under the 
instructions of the Chair. 


2. The head of the secretariat shall be responsible for the due and timely performance of the 
tasks of the secretariat. 


Article 15 — Budget 


1. The budget allocated to the Board is subject to a dedicated Title of the EDPS budget. 


2. The Chair in liaison with the EDPS should provide financial reports on a regular basis to the 
plenary. 


Article 16 — Travel costs and reimbursement 


One representative of each Member State shall be entitled to the reimbursement of their 
travel expenses for the participation to the expert subgroups as well as plenary meetings. 
Representatives from EFTA EEA States shall not be entitled to reimbursement. 


Article 17 — Internal information and communication system 


1. The secretariat of the Board shall provide an information and communication system in 
particular to support the electronic exchange of documents within the cooperation and 
the consistency mechanisms. 


2. The secretariat shall grant access to the information and communication system to the 
members of the Board, to the Commission, to the EFTA EEA supervisory authorities, to 
other supervisory authorities and to the single contact point (recital 119 GDPR) upon 
notification by the members as provided for under national law. 


TITLE V — WORKING METHODS 


Article 18 — Plenary meetings of the Board 


1. The ordinary plenary meetings shall be convened by the Chair not less than three weeks 
prior to the meeting. The secretariat shall issue the invitation to each member. Where 
technically feasible and secure, participants may attend ordinary meetings remotely 
through videoconferencing or other technical means. 
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. Extraordinary plenary meetings may also be convened by the Chair, on its own initiative or 


at the request of the majority of the members of the Board entitled to vote. Extraordinary 
plenary meetings shall be convened by the Chair at least one week before the meeting. 
Participants may, where technically feasible, attend the extraordinary plenary meetings 
remotely through videoconferencing or other technical means approved by the Board. 


. The Chair shall direct the proceedings during the meeting. If the Chair is unable to attend, 


they shall designate a deputy chair who will represent them at the meeting. 


. Plenary meetings shall only take place if at least half of the members entitled to vote or 


their representatives are attending. 


Article 19 — Agenda of plenary meetings 


1. 


The draft agenda of the plenary meetings shall be prepared by the Chair in liaison with the 
deputy chairs and the secretariat, then distributed to the members and other approved 
external participants for the relevant parts of the agenda at least two weeks before the 
meeting. In cases of extraordinary plenary meetings, the agenda shall be sent together 
with the invitation to the meeting. 


. Members may submit requests to include, delete or substitute an item of the draft agenda. 


The Chair shall inform all the members of these requests. 


. The draft agenda shall be adopted at the beginning of each meeting. If requests for 


inclusion, deletion or substitution of items have been submitted, they shall be voted on 
separately and shall be accepted if a simple majority of members so agrees. 


. A public version of the draft agenda shall be published on the website of the Board. 


. Invited experts, observers or other guests participating in a plenary meeting shall be 


mentioned in the respective agenda and the discussions points which they will attend. 


Article 20 — Documents for plenary meetings 


1. 


As a rule, all relevant documents shall be sent to the members by the secretariat at least 
10 calendar days before a meeting takes place or one week in case of an extraordinary 
plenary meeting. In exceptional circumstances, given the importance of the matter or the 
urgency, documents may be distributed later. Unless the discussion on the topic is urgent 
or mandatory, the Board shall decide whether or not to discuss the documents which are 
not submitted in time. 
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2. 


Each topic submitted to the Board shall be accompanied by an information note 
summarizing the context and the key issues on which the Board will have to discuss or 
decide. 


Article 21 — Minutes and follow-up of plenary meetings 


1. 


After the approval of the Chair, the secretariat shall prepare the draft minutes of the 
plenary meetings and send them for comments to all members no later than three weeks 
after the plenary meeting. A list of participants to meetings should be added to the 
minutes. 


. The draft minutes shall include a summary of the discussions, a record of the conclusions 


reached, the decisions adopted, and as the case may be the numerical result of vote(s). It 
shall also include the list of documents submitted and their status. The positions of the 
supervisory authorities of the EFTA EEA States shall be recorded separately. 


. The draft minutes shall be approved by the members entitled to vote at the next plenary 


meeting or according to the voting procedure laid down in Article 24 of these Rules of 
Procedure. 


. The conclusions reached and the follow-up actions to be undertaken shall be summarized 


by the Chair at the end of discussions on each agenda point. A to-do-list shall be drafted 
by the secretariat and sent to the members, the expert subgroups and rapporteurs after 
approval of the Chair no later than one week after the meeting. 


Article 22 — Voting Procedures relating to plenary meetings 


1. 


Unless otherwise provided for by the GDPR, the Board shall take decisions by simple 
majority of its members entitled to vote. Before voting, consensus should be sought. 


. In event of a tie, the vote is considered as negative, except in cases foreseen under Article 


65 (3) GDPR. 


. All majorities referred to by the GDPR or by these Rules of Procedure always refer to the 


total number of members of the Board entitled to vote regardless of whether they are 
present or not. 


. In principle, voting shall not be secret, unless where specifically foreseen in these Rules of 


Procedure or where supported by a majority of the members of the Board entitled to vote. 


. Every member of the Board entitled to vote who is not represented at a plenary meeting, 


can delegate its voting rights to another member of the Board entitled to vote and 
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attending the plenary meeting. The Chair and the secretariat shall be notified of any 
delegation of voting rights. 


6. After the vote, the Chair shall declare whether the proposal was approved or not. 


Article 23 — Language, interpretation during meetings and translation 


1. The working language of the Board shall be English. Live interpretation should be provided 
in all official languages of the EU at ordinary plenary meetings of the Board. 


2. Documents drafted by the supervisory authorities for the procedures foreseen under 
Articles 64 — 66 GDPR and Article 70 GDPR shall be submitted in English. 


3. Exceptionally, where an existing document submitted by a member of the Board is of 
interest for other members, this document shall be translated into English by the 
secretariat after approval by the Chair, pursuant to Article 75 (6) (e) GDPR, before being 
communicated to the members. However, the translation provided in this paragraph and 
the translation referred to in Articles 10 (1), 11 (2), 11 (3) and 13 (2) of these Rules of 
Procedure shall not apply to EFTA EEA members. 


4. Documents adopted pursuant to Articles 64 — 66 GDPR and Article 70 GDPR shall be 
translated into all official languages of the EU. Other adopted documents or summaries 
thereof shall be translated into all official languages of the EU, if the Board decides so. 


Article 24 — Written voting procedure 


1. The Board can decide by simple majority from its members entitled to vote to submit 
documents or decisions to a written voting procedure. 


2. The Chair may decide to submit documents or decisions to a written voting procedure 
where appropriate e.g. when a decision must be taken before the next plenary meeting. 
The Chair shall inform the members as soon as possible of the need and the reasons for a 
written voting procedure. 


3. When a written voting procedure has been decided, the secretariat shall send to all 
members the invitation to the written voting procedure and make the relevant documents 
available. Members shall vote within one week once it is sent by the secretariat, unless the 
Chair expressly sets another deadline if necessary. 


4. When a written voting procedure has been decided by the Chair in accordance with 
paragraph 2 of this Article, the written voting procedure shall be suspended if at least three 
members entitled to vote request for the suspension of it before the end of the voting 
period. 
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5. 


7. 


A written voting procedure decided by the Board pursuant to paragraph 1 of this Article 
may be suspended by the Chair upon request of one member of the Board submitted 
before the end of the voting period if new circumstances appear which were unknown 
when the written voting procedure was decided and that may substantially affect the 
outcome of the procedure. 


. Where the written voting procedure is suspended, the matter shall be discussed during 


the next plenary meeting of the Board, which may decide to submit the matter to a new 
written voting procedure. 


Paragraphs 1 - 6 of this Article shall also apply in the context of electronic voting procedure. 


Article 25 — Expert subgroups 


1. 


The Board shall create expert subgroups to assist with the performance of the tasks of the 
Board. 


. The establishment, suspension or termination of an expert subgroup may be decided at 


any time upon proposal of the Chair or of at least three members of the Board. In any case, 
the list of expert subgroups shall be reviewed by the Board in the first plenary meeting of 
each year. 


. The coordinator of each expert subgroup shall be designated by the Board for a renewable 


term of two years. 


. Expert subgroups shall be composed of supervisory authorities upon notification by the 


members of the Board and of the EDPS, and of staff members of the secretariat in support 
of the subgroup. 


. Where a member of an expert subgroup cannot attend a meeting, they may be 


represented by another member. The coordinator shall be notified of such representation. 


. Expert subgroups shall work in accordance with the work program adopted by the Board. 


An annual draft plan should be prepared at the beginning of each year by the coordinator, 
indicating the number of meetings and, as detailed as possible, the schedule and items to 
be addressed. 


. Expert subgroup meetings should be scheduled and conducted to support the 


effectiveness of the decision-making process of the Board, in particular to meet the 
deadlines of the GDPR. 
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. Following a specific mandate from the Board or, in urgent cases, upon decision of the Chair, 


new topics can be added to the work program of an expert subgroup. In this case, the 
members of the expert subgroup and the Board shall be informed without delay. In these 
urgent cases, the Board shall be asked to confirm the mandate at the next Plenary. 


. Expert subgroup meetings should be planned well in advance by the coordinator, together 


with the secretariat and the rapporteur(s) concerned. The planning of meetings should 
take into account budgetary constraints and should be coordinated to ensure consistency 
with the tasks of other subgroups. 


10. As a general rule, the expert subgroups should meet in person in Brussels. Where possible 


or necessary, in urgent cases, expert subgroup meetings may take place by way of 
telecommunication and/or videoconferencing, information exchange or according to the 
voting procedure laid down in Article 24 of these Rules of Procedure. 


Article 26 — Role and responsibilities of the coordinators of expert subgroups 


1. 


The coordinator chairs the expert subgroup meetings in a neutral manner and acts as a 
contact point in all respective matters. The Chair may act as a coordinator. 


. Once a meeting has been scheduled, the coordinator should, via the secretariat, send to 


the expert subgroup members a draft agenda without delay and in any event 10 days in 
advance of the meeting. Members may propose additional topics to be dealt with by the 
subgroup. Relevant documents for the meeting should be circulated as early as possible by 
the coordinator or rapporteurs or members of the subgroup via the secretariat. 


. The coordinator ensures that for all work items on the agenda, a mandate has been given 


by the Board or upon decision by the Chair. 


. The coordinator assisted by the secretariat for the drafting shall ensure that a summary of 


discussions and the conclusions of the subgroup meetings are documented for each 
agenda point in the minutes which shall be circulated to the members of the subgroup for 
approval. 


. The coordinator works in close cooperation with the Chair and the secretariat on items to 


be prepared by the expert subgroup for plenary meetings. 


. The coordinator ensures that for each of those items to be prepared for plenary meeting, 


an information note is drawn up by the rapporteur or the secretariat, in liaison with the 
expert subgroups, before the deadline indicated by the Chair. Then it is sent via the 
secretariat, to the members of the Board. The information note should contain a summary 
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of the relevant facts and the state of play of discussions in the subgroup and should contain 
a recommendation or request for action by the plenary, if required. 


Article 27 — Role and responsibilities of rapporteurs 


1. The Board or the Chair may designate one or several (co-) rapporteur(s) for specific issues 
on a case-by-case basis, with the assistance of the secretariat for the drafting of 
documents, decisions or other measures by the expert subgroups and/or the Board. As a 
principle, supervisory authorities shall be designated as rapporteurs. The secretariat can 
also act as rapporteur. 


2. The (co-) rapporteur(s) is/are responsible for the elaboration of documents, incorporating 
comments into revised drafts, finalizing the document and presenting them to the plenary 
including the advice of the subgroup on possible follow-up steps, with the support of the 
secretariat (Article 75 (5) and (6) (g) GDPR). 


Article 28 — Working methods of expert subgroups 


1. Expert subgroups shall as a general rule, always seek consensus for any proposal submitted 
to the Board. 


2. In cases where consensus cannot be reached under paragraph 1, the expert subgroup shall 
decide to submit a document to the plenary for a vote by simple majority of all present 
members by show of hand. The dissenting positions should be described and alternative 
options for decisions should be presented to the plenary. 


Article 29 — Board work program 


The Board shall adopt a two-year work program. 


Article 30 — Consultation of interested parties 


The Board shall, where appropriate, organize consultations of interested parties in 
accordance with Article 70 (4) GDPR. The means and consultation period shall be decided on 
a case-by-case basis. 


TITLE VI — GENERAL PROVISIONS 


Article 31 — Access to meetings 


Attendance to the plenary and expert subgroup meetings is restricted to persons mentioned 
in Article 4 (Membership and Participation), Article 8 (Observers), Article 9 (External experts, 
guests and other external parties) and persons identified in Article 25 (4) of these Rules of 
Procedure. 
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Article 32 — Access to documents 


1. The public shall have access to documents held by the Board in accordance with the 
principles laid down by Regulation (EC) No 1049/2001 for public access to European 
Parliament, Council and Commission documents. 


2. Any initial application for access in the meaning of Article 7 of Regulation 1049/2001 shall 
be handled and signed by one of the deputy chairs. Any confirmatory application for 
access in the meaning of Article 8 of Regulation 1049/2001 shall be handled and signed 
by the Chair. 


Article 33 — Confidentiality of discussions 


1. In accordance with Article 76 (1) GDPR, discussions of the Board and of expert subgroups 
shall be confidential when: 

a) they concern a specific individual; 

b) they concern the consistency mechanism; 

c) the Board decides that the discussions on a specific topic shall remain confidential 
for instance when the discussions concern international relations and/or where the 
absence of confidentiality would seriously undermine the institution's decision- 
making process, unless there is an overriding public interest in disclosure. 


2. The Chair or expert subgroup coordinators shall take the appropriate measures to ensure 
confidentiality. 


Article 34 — Data protection 


In accordance with the regulation on the protection of individuals with regard to the 
processing of personal data by EU institutions and bodies, the Board shall appoint a data 
protection officer who shall report to the Chair. 


Article 35 — Annual report 


Pursuant to Article 71 GDPR, the Board shall publish an annual report on the website of the 
Board. 


The annual report shall be available in English and its executive summary shall be available in 
all official languages of the EU. 


Article 36 — Representation of the Board before the Court of Justice of the European Union 


The Chair or, according to the allocation of tasks agreed, the deputy chairs, shall appoint the 
agent(s) representing the Board before the Court of Justice of the European Union. 
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TITLE VII — Coordinated Supervision Committee 


Article 37 - Coordinated Supervision Committee 


1. 


Article 62 of Regulation 2018/1725, and other legislative acts of Union law, provide that 
coordinated supervision by national supervisory authorities and the European Data 
Protection Supervisor takes place within the framework of the Board. A coordinated 
supervision committee is established for this purpose. 


The Coordinated Supervision Committee (the “Committee”) shall pursue the objectives of 
its participating authorities, each acting within the scope of their respective competences 
and within the framework of their responsibilities, to exchange relevant information, 
assist each other in carrying out audits and inspections, examine any difficulties with the 
interpretation or application of Regulation 2018/1725 and other applicable Union acts, 
study problems with the exercise of independent supervision or with the exercise of the 
rights of data subjects, with the aim of pursuing harmonised solutions, to any problems 
and promote awareness of data protection rights. 


The Committee shall adopt its own Rules of Procedure and working methods, allowing for 
its autonomous functioning and positioning. The participation to the Committee is 
without prejudice to the applicable rules on the Board’s membership and participation 
provided for in Article 4 of these Rules of Procedure. The participation to the Committee 
may differ from the Board’s membership and participation, in accordance with the Union 
acts establishing the Union’s IT system, body, office or agency for which coordinated 
supervision shall be established. 


The Committee shall meet at least twice a year. The meetings of the Committee may take 
place in different formations, depending on the Union’s IT system, body, office or agency 
for which coordinated supervision shall be conducted, to be guided by the respective 
Union act. 


In cases referred to in Article 42 (4) of Regulation (EU) 2018/1727 on the European Union 
Agency for Criminal Justice Cooperation (Eurojust), the Board may adopt a position in 
accordance with Article 22 of these Rules of Procedure. 


Once adopted by the Committee, the Board shall submit the joint report of coordinated 
supervision activities to the European Parliament, to the Council, and to the Commission. 
Prior to the Board’s communication, the joint report of coordinated supervision activities 
shall be presented at a plenary meeting of the Board for information. The Chair of the 
Board may, when necessary and upon request, communicate other Committee 
documents adopted in accordance with the Committee’s own Rules of Procedure and 
working methods. 
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7. The secretariat of the Board shall provide the secretariat of the Committee. The 
secretariat of the Board shall make Committee documents available on the Board’s 
website, through a dedicated webpage. 

TITLE VIII - FINAL PROVISIONS 

Article 38 — Revision of the Rules of Procedure 


1. Amendments to these Rules of Procedure may be proposed by the Chair, or by one of the 
members of the Board. 


2. Amendments shall be adopted in accordance with Article 72 (2) GDPR. These Rules of 
Procedure shall be reviewed within two years after their adoption by the Board. 


Article 39 — Website of the Board 


1. All the final documents adopted by the Board shall be made public on the Board’s website, 
unless the Board decides otherwise. 


2. The website of the Board shall be available in English. The static parts of the website and 
the press releases should also be available in all official languages of the EU. Speeches 
should be available in the original language and news should be available in English. 


Article 40 — Calculation of time limits 


In order to calculate the periods and time limits expressed in the GDPR and in these Rules of 
Procedure, Regulation 1182/71 of the Council of 3 June 1971 determining the rules applicable 
to periods, dates and time limits shall apply. 


Article 41 — Entry into force 


These Rules of Procedure shall enter into force on the date of their adoption by the Board. 
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